Merge branch 'rs-dev-issue-2613' into 'master'

Add custom protocol whitelisting to SanitizationFilter

Addresses internal https://dev.gitlab.org/gitlab/gitlabhq/issues/2613

We allow any protocol for autolinks: irc://irc.freenode.net/git

But manual Markdown links with the same protocol get sanitized: `[This will not be clickable](irc://irc.freenode.net/git)`: [This will not be clickable](irc://irc.freenode.net/git)

To get around this we have to first allow *all* protocols, and then manually clean dangerous (i.e., `javascript:`) protocols.

See merge request !1496

1 files changed, 19 insertions, 0 deletions

diff --git a/lib/gitlab/markdown/sanitization_filter.rb b/lib/gitlab/markdown/sanitization_filter.rb
index e368de7d848..ffb9dc33b64 100644
--- a/lib/gitlab/markdown/sanitization_filter.rb
+++ b/lib/gitlab/markdown/sanitization_filter.rb
@@ -48,6 +48,12 @@ module Gitlab
         # Allow span elements
         whitelist[:elements].push('span')
 
+        # Allow any protocol in `a` elements...
+        whitelist[:protocols].delete('a')
+
+        # ...but then remove links with the `javascript` protocol
+        whitelist[:transformers].push(remove_javascript_links)
+
         # Remove `rel` attribute from `a` elements
         whitelist[:transformers].push(remove_rel)
 
@@ -57,6 +63,19 @@ module Gitlab
         whitelist
       end
 
+      def remove_javascript_links
+        lambda do |env|
+          node = env[:node]
+
+          return unless node.name == 'a'
+          return unless node.has_attribute?('href')
+
+          if node['href'].start_with?('javascript', ':javascript')
+            node.remove_attribute('href')
+          end
+        end
+      end
+
       def remove_rel
         lambda do |env|
           if env[:node_name] == 'a'